Unconditionally secure single qubit quantum secret sharing 
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Analyzing carefully an experimentally feasible non-entangled single qubit quantum secret sharing 
protocol and its modified version [Phys. Rev. Lett. 95, 230505 (2005); ibid. 98, 028902 (2007)], 
it is found that both versions are insecure against coherent attacks though the original idea is so 
remarkable. To overcome this fatal flaw, here we propose a secure protocol with a distinct security 
checking strategy, which still involves single qubit operations only, making it possible to achieve 
unconditionally secure quantum secret sharing with current technology. 
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Consider a committee of N members, one of which has 
a set of secret data, e.g., the password for a locker or 
the access code for a computer program. He wants oth- 
ers to share the data in such a way that the data can 
be regained if all of these N — 1 members collaborate, 
while any subset of less than N — 1 members cannot do 
so successfully. This is a typical secret sharing prob- 
lem. Secret sharing is also an element for building up 
many other complicated cryptographic protocols. But 
in classical cryptography, unconditional security cannot 
be achieved in principle. With the fascinating develop- 
ment of quantum cryptography, using quantum methods 
to achieve secure secret sharing has caught great inter- 
ests both theoretically and experimentally^ [2 [1, [3, 
However, most of the quantum secret sharing (QSS) pro- 
tocols have to rely on entangled quantum states. So far, 
the preparation of entangled states has still been quite 
inconvenient in practice, and it has been even harder to 
store them for more than a brief time, especially when 
different parts of the entangled states are shared and kept 
separated by different participants. For this reason, even 
though some of these protocols can be demonstrated in 
laboratory, they are likely still far from practical appli- 
cations. 

Recently, a novel QSS protocol was proposed and ex- 
perimentally demonstrated by Schmid et al. 7} , which in- 
volves non-entangled single qubits only. Thus the pro- 
tocol is very promising in practice. However, a subtle 
security loophole was found later Q. A modification on 
the original protocol was then proposed by Schmid et 
al.^Q. But here it will be shown that the modified one 
is even less secure than the original one. Most impor- 
tant, we propose a new protocol with a distinct security 
checking strategy, which closes the security loophole suc- 
cessfully and makes the protocol unconditionally secure. 



Meanwhile, the great feasibility of the original protocol 
is still maintained. Therefore, the present protocol is of 
significance both theoretically and practically. 

Let us first recall briefly the original QSS protocol pro- 
posed by Schmid et aZ.0]. The goal of the proposal is 
that: after each of N participants inputs the secret data, 
any N — 1 participants should be able to infer the secret 
input of the remaining participant if and only if they 
collaborate. Let |0) and |1) denote the two orthonor- 
mal states of a qubit. Define |±x) = (|0) ± |l))-\/2 and 
\±y) = (|0) ± i \ l))/y/2. The original protocol is actually 
stated as follows. 

(1) The first participant R\ prepares a single qubit in 
the state \+x). 

(2) The qubit is passed through the N participants se- 
quently. Each participant Rj (j = 1, N) chooses the 
secret data ipj £ {0, 7r/2, tt, 3tt/2}, and acts on the qubit 
with the unitary phase operator 
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(3) The last participant i?jv measures the qubit in the 
basis \ix). This completes one run of the qubit commu- 
nication. 

(4) Each participant divides his action for every run 
into two classes: a class X corresponding to ipj € {0, it} 
and a class Y corresponding to (pj € {t/2, 3tt/2}. They 
broadcast the class of their action for each run in random 
order, but keep the particular value of tpj secret. 

( 5) With the announced classification, they deter- 
mine which runs are valid runs that satisfy the condi- 
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surement result of Rn. 

(6) The security check: the participants choose a sub- 
set of valid runs, and announced the value of ipj of each 
participant in random order. They make comparison be- 
tween these values and the measurement result in step (3) 
to detect cheating. 
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( 7) The task of secret sharing is achieved with the re- 
maining valid runs. When any subset of N — 1 partic- 
ipants wants to infer the choice of ipu of the remaining 
participant, they reveal among themselves their values of 
ipj . In the case in which this subset contains the last par- 
ticipant, he reveals the measurement result in step (3). 

A significant merit of this protocol lies in that only the 
local manipulation of phases on a communicated single 
qubit is needed, and thus it is very feasible for practical 
realization. Unfortunately, although the protocol can in- 
deed accomplish the task that any N — 1 participants are 
able to infer the choice of ipn of the remaining participant 
if they collaborate, it was shown in Ref.[8| that a subset 
of less than N — 1 participants may also reach this goal 
in certain cases, namely, the protocol does not reach the 
security it was supposed to have. The cheating strategy 
in Ref.[8] is outlined below. 

Cheating strategy A: 

Suppose that the kth participant Rk (k £ {2, ...,N — 
1} ) is dishonest. According to Eq. the state of 

the qubit he receives from Rk-i in step (2) is \xk-l) = 



(10) 



|l))/\/2. In contrast to what he should 



do in the honest protocol, he does not apply the operator 
Uk(fk) on it to obtain Xk and then pass it to the next par- 
ticipant Rk+i- Instead, he keeps the qubit unmeasured. 
He also prepares an EPR pair \ip<f>) — (|00) + \U))/y/2, 
and sends the second qubit <f> to Rk+i as Xk while keep- 
ing ip to himself. In step (4) when it is time for him to 
broadcast the class of his action, since the order in which 
the participants announce the classification is randomly 
chosen, there can be two cases: 

(i) Some Rj (j < k) has not broadcast the class of 
his action yet. Then Rj will take no advantage from the 
cheating. But he will not be caught either. This is be- 
cause he can perform a collective measurement on Xk-i 
and ij) to make the qubit f> received by Rk+i collapse to 
U(ipk)\Xk-i)> where the class of the action correspond- 
ing to tpk can be inferred from the result of his collective 
measurement. Later, when he is required to announce 
the exact value of ipk for the valid runs in step (6), he 
can also infer this value since a run is recognized as valid 
only when all participants have announced their classes 



of actions so that 



can be calculated in step 



cos(Ej <Pj) 

(5). And ipk can be calculated as long as Rk knows all 
the classes of actions of Rj (j < k). Thus he can always 
broadcast correctly. 

(ii) All Rj (j < k) have broadcast the class of their 
action. Then it is sufficient for Rk to determine a proper 
basis so that he can know the exact state of Xfe-i by mea- 
suring it. He also measures ip to collapse cf> into either 
|±x) or |±y), and he compares the result of (j) with the 
state of Xk-i to infer the correct value of ifk to broad- 
cast. Again, his cheating will not be detected. But in this 
case he knows the exact state of Xk-i an d Xk without 
the help of any other participants. Then a subset of less 
than N — 1 participants with Rk included will be able to 
infer the choice of ipn of another participant. 



Responding to this cheating strategy, Schmid et al. 
proposed a modified protocol @, where they attempt to 
ensure that the second case never occurs and thus would 
make the cheating futile. 

Modified protocol 1: 

All steps are the same as those of the original protocol, 
except that in step (4), the order in which the participants 
announce the classification is no longer random, but al- 
ways reverse to the order of the qubit transmission. That 
is, since in step (2) the qubit is passed through the par- 
ticipants in the order R\ — > i?2 — > ••■ Rn-X ~ * Rn, 
in step (4) the class choice must be revealed in the order 
Rn — ► Rn-i — * •■■ — ► Ra ~~ * R\- 

This modified protocol indeed evades the second case 
of the cheating strategy, however, it is still insecure with 
even poor security, as shown below. 

Cheating strategy B: 

Similar to cheating strategy A, after the dishonest par- 
ticipant Rk (k £ {2, N — 1}) receives the qubit Xk-i 
from Rk-i, he does not apply Uk(<Pk) on it and pass it to 
Rk+i- He prepares an EPR pair \i>4>) = (|00) + |11))/V2, 
and sends the second qubit <f to Rk+i as Xk while keeping 
tjj to himself. But the difference is that he needs not to 
keep Xk-i unmeasured in this strategy. Instead, he can 
measures it immediately in the basis |±x) or |±y). 

In step (4), when it is time for Rk to broadcast the 
class of his action, all Rj (j > k) have broadcast the 
class of their action since it was suggested in modified 
protocol 1 that the class choice is broadcast in the reversed 
order. Rk then counts the number of the class Y action 
among Rj (j > k). If the number is even (or odd), he 
measures the qubit if in the basis |±x) (or |±y)J. Thus 
he can infer the state of <f> (i.e., Xk) from the entangled 
form of \ip(p)- By comparing the state with the result in 
his previous measurement on Xk-i> he can always infer 
the exact value of ifk and finish the rest of the protocol 
successfully, just as if he had applied the operator Uk(<Pk) 
on Xk-i and then passed it to Rk+i without cheating. 
But unlike the honest protocol, in this case he always 
knows the exact states of both Xk—i and Xk for any valid 
run. Therefore among the first k participants (i.e., all Rj 
with j ^ k), any subset of N' = k — 1 participants with 
Rk included can infer the choice of tpn of the remaining 
participant. Also, among the last N — k + 1 participants 
(i.e., all Rj with j k), any subset of N' = N — k par- 
ticipants with Rk included can infer the choice of tfR of 
the remaining participant. Especially, if the participant 
Ri ( Rn-i) cheats with this strategy, he alone can always 
know the choice of (pi (<Pn) of the first (last) participant. 

Therefore, the modified protocol 1 is not secure either. 
Moreover, unlike the case of the original protocol, where 
the cheating strategy A can only gain information on 
the secret data in certain cases, the cheating strategy B 
can always be successful for the modified one. In addi- 
tion, the cheating strategy B is more feasible to be im- 
plemented, because no collective measurements on Xfe-i 
and tjj are required, while they are needed in the cheating 
strategy A. The cheater here even needs not to store the 
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qubit Xfe-i f° r a l° n g period of time. Consequently, the 
modified protocol 1 proposed in Ref. @ is even less secure 
than the original one. 

If we want to defeat only the above cheating strategies 
alone, we would have the following simple solution. 

Modified Protocol 2: 

All steps are the same as those of the original protocol, 
except that in step (4), the order in which the participants 
announce the classification can be arbitrary, as long as 
the participants R\ and Rn are always the last two to 



announce. 



With this modification, when R k (k € {2, ...,N - 2}) 
broadcasts the class of his action in step (4), the cases 
where either all Rj (j > k) or all Rj (j < k) have broad- 
cast the classes of their actions will never occur. Mean- 
while, i?i and Rn can gain no extra information from this 
modification, because the state of the qubit they send or 
receive are always known to them even in the honest pro- 
tocol. Thus the protocol is made secure against the above 
two cheating strategies. 

Unfortunately, there are still some serious drawbacks 
in this one. First, it cannot stand the multi-cheater 
attack. Suppose that there are two cheaters, Rk (k € 
{2, N — 2}) and i?i (or Rn), and they exchange infor- 
mation secretly. Then although R\ and Rn are always 
the last two to announce the classes of actions, it is still 
possible for Rk to know the classes of actions of all Rj 
(j > k) or all Rj (j < k) before he announces his own. 
This is because Rn (or i?i) may tell Rk his choice se- 
cretly, or they may even have agreement beforehand on 
the routine on how Rn (or Ri) makes his choice so that 
they need not to communicate during the process of the 
protocol. Thus one of the above cheating strategies may 
still work. Similarly, even if we put further restrictions on 
the order of the broadcast of the classes of actions (e.g., 
by fixing the order as Rn/2 — * Rn/2+i —> Rn/2-i — * 
Rn/2+2 Ri — > Rn when TV is even), it is still 

possible to cheat if more participants are dishonest. Sec- 
ond, none of the above three versions is able to locate 
the cheater(s). Even if the participants find disagreed 
announcement in the security check, what they know is 
merely the existence of cheater (s), but they never know 
exactly who is(are) cheating. Because of this, a dishon- 
est participant surely inclines to cheat as he is benefitted 
from a successful cheating while has no risk to be caught, 
even if the cheating fails. In fact, even if a cheater does 
not have the technical power to implement the above 
cheating strategies, he can still cheat with the simple 
intercept-and-resend attack. That is, when he receives 
the qubit, he simply measures it with a randomly chosen 
basis and then passes it to the next participant. Indeed, 
as shown in Ref.Q, this cheating stands a non-trivial 
probability to be detected. But since the participants 
cannot locate which one is the cheater and the informa- 
tion obtained by the cheater is also non-trivial when the 
cheating is successful, a dishonest participant surely likes 
to take the risk. 

To achieve a mission of unconditional security, be- 



low we present a secure protocol with a distinct security 
checking strategy. 
Our secure protocol: 

(I) The N participants agree on the number n of 
the total runs of the qubit communication, a weight w 
( w > 0.6n is recommended), and a Boolean matrix G as 
the generating matrix of a binary linear (n,k,d)-code C 
fldl] , where d satisfies n[l — Aw 2 /('in 2 — 2nw + 3iu 2 )] < 
d < 2(n — w). Each participant Rj (j — 2, ...,N — 1 ) 



chooses secretly an n-bit codeword 



{Cj lCj2 ...Cj n ) 



from C whose weight (the number of 1 in Cj) is w. 

(II) For i — 1 to n: 

(II-l) The first participant R\ prepares a single 
qubit in the state \+x) . 

(IT2) The qubit is passed through the N partic- 
ipants sequently. Each participant Rj (j = l,...,N) 
applies an action on the qubit. For the participant Rj 
(j = 2, ...,N — 1 ), the action is chosen according to the 
ith bit of the codeword Cj. If Cji = 0, Rj applies a class 
X or Y action; else if Cji = I, Rj applies a class Z ac- 
tion. The participants R\ and Rn apply the class X or 
Y action only. Here, the class X and Y actions are de- 
fined as the same as those in the original protocol. The 
class Z action means that Rj chooses the secret data 
ifji G {0, 7r/2} and acts on the qubit with Uj(<fji), then 
measures the qubit in the basis \ix). He then chooses an- 
other secret data ipj2 £ {0, 7r/2, 7r, 37r/2} and acts on the 
measured qubit with Uj(ifj2), and sends the qubit to the 
next participant. All these (p are independently chosen 
for each run. 

(ITS) The last participant Rn measures the qubit 
in the basis \ix). 

(III) For i = 1 to n, each participant Rj (j = 
2, ...,N — 1) announces the bit Cji in random order. 

(IV) Security check 1: the participants check whether 
each Cj (j — 2, N — 1) is a codeword from C with the 
weight w. 

(V) For i = 1 to n, the participants who announced 
Cji = broadcast the classes of their actions in random 
order. 

(VI) The participants determine which runs are valid 
runs, i.e., the runs which contain no class Z action 
(i.e., Cji — for Vj G {2,...,N — 1}) and satisfy 

1. 



C0S(^ - tfj 



(VII) Security check 2: the participants choose a sub- 
set of valid runs and all the runs containing the class Z 
action. For each valid run, each participant announces 
his choice of ipj in random order. They compare these 
values with the measurement result in step (ITS) to detect 
cheating. For each run containing the class Z action, the 
participants who applied the class X or Y action (except 
Ri and Rn ) announce their choices of tfj in random 
order. Then R\, Rn and these who applied the class Z 
action announce all their choices of ipji (including <Pn) 
and the results of the measurement first and then (fj2 
(including (f\), and check whether they are in agreement 
with the announcements of the other participants. 



4 



(VIII) When no disagreement is found, the task of se- 
cret sharing is thus achieved with any of the remaining 
valid runs. When any subset of N — 1 participants want 
to infer the choice of <pn of the remaining participant, 
they reveal among themselves their values of tpj and the 
measurement result in step (IIS) if the last participant 
is included in this subset. 

Obviously this protocol can accomplish the task that 
any subset of N — 1 participants can infer the choice of 
ipn of the remaining participant if they collaborate. Also, 
the protocol can meet the requirement that any subset 
of less than N — 1 participants cannot infer the choice of 
ipn of a honest participant, as shown below. 

Let us consider the most severe case where N —2 par- 
ticipants are cheaters, and they can exchange any infor- 
mation they know. Surely, if the protocol is proven to 
be secure in such a setting, it is secure in any other set- 
tings. In the following it will be rigorously proven that 
the N — 2 cheaters cannot infer the secret choice of each 
of the two honest participants without being detected, 
unless with a probability which can be made arbitrarily 
small as n increases. 

Let R a and Rb (a < b) denote the two honest par- 
ticipants. Consider first the case where R a and Rb are 
neighbors in the qubit transmission, i.e., b = a + 1. Ob- 
viously the other N — 2 cheaters can infer the value of 
cos(y a + Lpb) only, instead of each secret data tp a or ipb 
alone, unless they perform a man-in-the-middle eaves- 
dropping attack between R a and Rb- But similar to the 
well-accepted security of the BB84 quantum key distribu- 
tion protocol [111], it is easy to understand that the eaves- 
dropper cannot escape from being detected when R a and 
Rb both apply the class Z action. Therefore, to infer any 
one of ip a or ipb, the N — 2 cheaters still need to collabo- 
rate with either Rb or R a , i.e., the collaboration of N — 1 
participants is needed so the protocol is secure. 

Secondly, consider the case where R a and Rb are sepa- 
rated. Since the object of the cheaters is to learn the state 
of the qubit sent by R a (or received by Rb) so that ip a (or 
<Pb) can be inferred, at least one cheater Rk (a < k < b) 
between R a and Rb must replace the honest action with 
a cheating one. In this cheating action, Rk must stop the 
qubit sent by R a so that its state can be learned, and 
he sends the next participant another qubit to continue 
with the protocol. The above cheating strategies A and 
B are both such examples. To pass the security checks, 
the cheating action must be able to be announced as a 
class X, Y or Z action when needed. But this cannot 
always be done, as proven by the following four steps. 

(a) To cheat successfully, the cheater Rk should be able 
to announce the cheating action as a class X or Y ac- 
tion. An honest class XorY action cannot be announced 
as a class Z action, because the participant cannot an- 
nounce the result of the measurement on the qubit he 
received correctly since he did not keep it. Therefore, 
although a cheating action can always be announced as a 
class Z action, if it cannot be announced as a class X or 
Y action, Rk must apply the honest class X or Y action 



for exactly n — w runs to pass security check 1. Then for 
any valid run, the action of Rk is honest, cheating being 
impossible. 

(b) Rk cannot announce the cheating action as a class 
X or Y action in a run where both R a and Rb applied the 
class Z action, or he will be detected in security check 2 
with a non-trivial probability. To announce the cheating 
action as a class X or Y action correctly, Rk needs to 
know tfk exactly. Similar to cheating strategies A and B, 
it can be seen that (pk can be inferred if Rk knows the 
class choices of all Rj (a ^ j < k) or all Rj (k < j ^ b). 
But if both R a and Rb applied the class Z action, they 
never need to announce their choice before Rk announces 
ifk in security check 2. Thus Rk has to announce the 
value of fk by guess, and stands a non-trivial probability 
to be detected. 

(c) The number of runs in which Rk can announce the 
cheating action as a class X or Y action without being 
detected is not sufficient for Rk to pass security check 1. 

From point (b), it is seen that Rk can safely announce 
the cheating action as any of the class X, Y or Z action 
freely only in the runs where he is sure that either R a or 
Rb applied a class X or Y action. Now let us evaluate 
the number of these runs. 

In each of the first n — d runs, Rk cannot know the 
choices of Cji of R a and Rb before they announce, be- 
cause the number of possible codewords is at the order of 
magnitude of 2 fc when d < 2(n — w). Since in step (III) 
Cji is announced in a random order, there are three possi- 
bilities: both R a and Rb announced before Rk does; one 
and only one of R a and Rb announced before Rk does; 
none of R a and Rb announced before Rk does. The prob- 
abilities for these cases to occur are 1/4, 1/2, and 1/4, 
respectively. In the first two cases Rk can be sure of the 
class of action of R a and/or Rb- Since each participant 
should apply the class Z action w times, the probabil- 
ity for c a i = (or cu = 0) is 1 — w/n. Therefore, the 
probability for such a run to be the one in which Rk can 
announce the cheating action as a class X or Y action is 



Pi 



(1 - w 2 jn 2 ) /4 + (1 - w/n) /2. 



(2) 



In each of the last d runs, since the string Cj of each 
participant Rj must be a codeword of C and the mini- 
mum distance between codewords is d, the choice of Cji 
(i G {n — d+ 1, .., n}) of each participant can be inferred 



by the others from the announced Cji (i S { 1 , 



-d}) of 



the first n — d runs. Thus Rk knows the choice of action 
of R a and Rb before they announce. The probability for 
such a run to be the one in which Rk can announce the 
cheating action as a class X or Y action is then 



P2 = 1 — w 2 /n 2 



(3) 



Totally, even if Rk applies the cheating action in all 
the n runs, the maximum number of runs in which he can 
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announce the cheating action as a class X or Y action is 

nf = (n— d)pi + dp 2 

= (n- d)[(l - w 2 /n 2 )/4+ (1 - w/n)/2] 

+d(l - w 2 /n 2 ). (4) 

Therefore, after Rk finishes applying all the actions 
(either honest or cheating ones) on the n qubits in step 
(II), the major part of the n-bit string Ck which he can 
announce in step (III) is already determined. Only n' 
bits at the most can be altered between and 1 by Rk 
according to the announcement of R a and Rb, while the 
other bits have to be announced honestly or announced 
as 1. Since it is suggested in the protocol to choose 
d > n[l — Aw 2 / (in 2 — 2nw + 3u> 2 )], from the above equa- 
tions it can be verified that d > n' . Accordin g to the 
property of the binary linear [n, k, e?)-code C |10| . al- 
tering less than d bits of a codeword will not result in 
another codeword since the distance between any code- 
words is not less than d, except with a trivial probabil- 
ity. Therefore, among all the possible strings which can 
be obtained by altering no more than n' bits of only 
those less than l/( n ~" 2 / ' 2 ) portion are valid codewords 
from C. Note that, which string is the one that can fi- 
nally be announced by Rk is determined by the position 
of the runs in which R a or Rb announced either c a % = or 
Cbi = before Rk announces Cki- Due to the random or- 
der of the announcement, Rk will generally not be so 
lucky that the final string which he can announce hap- 
pens to be a valid codeword while has also the weight 
w exactly, except with a probability which can be made 
arbitrarily small by increasing n. Thus Rk cannot pass 
security check 1 by altering n' bits of Cfc. 

(d) Seen from the above points, the probability for Rk 
to cheat successfully is arbitrarily small as n increases. 
Point (c) ensures that Rk is unable to cheat successfully 
by altering his announcement on the choice of action only 
in the runs in which R a or Rb, announced either c a i = 
or cu — before Rk announces Cki- On the other 
hand, a dishonest Rk may take the risk to announce the 
cheating action as a class X or Y action in the runs 
where both R a and Rb applied the class Z action, so 
that the announced string Ck can be a valid codeword 
with the weight w. But it was proven in point (b) that 
in any single run, announcing the cheating action as a 
class X or Y action stands a non-trivial probability to 
be detected. Let e denotes this probability. Since the 
minimum distance d between codewords increases with n, 
the number of runs in which both R a and Rb applied the 
class Z action while Rk needs to announce the cheating 



action as a class X or Y action to make Ck valid will also 
grow as n increases. Thus the total probability for Rk 
to pass the whole protocol without being detected will 
be (1 — e) oljl \ which can be made arbitrarily small by 
increasing n. 

At this stage, it is seen that no cheating could be suc- 
cessful with a non-trivial probability. Moreover, when R a 
and Rb detected cheating, they know that the cheater is 
located between a and b. In the case where b = a + 2 or 
more participants are honest and n is sufficiently large 
so that the values of a and b run through many different 
combinations, the cheater can be more precisely located. 

We wish to emphasize that, implementation of our pro- 
tocol involves merely single qubit operations, which may 
easily be realized with the technology reported in Ref. [3] . 
For example, by pumping a /3-barium borate (BBO) crys- 
tal with a violet single mode laser diode, photons can 
be generated via a type II spontaneous parametric down 
conversion (SPDC) process. The initial polarization state 
can be prepared by placing a polarizer vertically in front 
of a trigger detector ensuring that only horizontally po- 
larized photons are used. The first participant uses a 
half- wave plate followed by a quarter-wave plate at an an- 
gle of 45°. By rotating the half- wave plate to the angles 
0°, 45° and 22.5°, -22.5° he could apply the phase shifts 
(pi S {7r/2, 37r/2} and (pi £ {0,7r} on the horizontally 
polarized photons to transform them into |±y) and |±x). 
As the photon passes through the participants, each of 
them can apply the phase shift ipj using yttrium vana- 
date (YVO4) crystals, which were cut such that their op- 
tic axis lies parallel to the surface and is aligned in such a 
way that horizontal and vertical polarization states cor- 
respond to their normal modes. By rotating the crystals 
along the optic axis for a certain angle, a specific relative 
phase shift tpj can be applied independently from the in- 
coming polarization state. Measurement of the photons 
can be done by detecting them with passively quenched 
silicon avalanche photo diodes (Si-APD) behind a half- 
wave plate at an angle of 22.5° followed by a polarizing 
beam splitter. The rest part of the class Z action, i.e., 
applying another phase shift 99^2 on the measured pho- 
ton and then resending it to the next participant, can 
be done by preparing another independent photon from 
the photon source and then adjusting its polarization to 
the proper value with half-wave and quarter-wave plates, 
with devices like those of the first participant. 
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